GlobalProtect App EUVD-2026-30101

Exploitation requires two simultaneous conditions: first, the attacker must be on the same adjacent network segment as the victim (AV:A) - achieved via physical co-location, ARP spoofing, DNS poisoning, or a rogue access point; second, the attacker must successfully establish a man-in-the-middle position on the TLS channel between the GlobalProtect app and a Palo Alto Portal or Gateway server (AT:P), meaning certificate validation must be bypassed or a trusted certificate must be available to the attacker. The vulnerability is triggered during the normal Portal/Gateway connection lifecycle - no special application feature needs to be enabled and no user interaction is required (UI:N), and no privileges on the victim system are required (PR:N). What limits exploitation: the MitM network position is a significant operational barrier; TLS certificate validation (if strictly enforced) provides an additional layer of resistance; SSVC explicitly marks this as not automatable, ruling out worm-style propagation. iOS clients are unconditionally excluded. No application-level configuration state or non-default setting is required - any endpoint running an affected version and capable of reaching a Portal or Gateway is vulnerable given the above network prerequisites.

The CVSS 4.0 score of 5.2 is a meaningful reflection of real attack constraints rather than a downplayed severity: AV:A (Adjacent Network) confines the attacker to the same broadcast domain or network segment, and AT:P (Attack Requirements: Present) mandates a successful MitM position - a non-trivial operational prerequisite. SSVC corroborates this with 'Automatable: no,' confirming mass-scale opportunistic exploitation is not feasible. EPSS at 0.01% (0th percentile) and E:U (Unreported exploit maturity) confirm no known exploit code exists. There is no CISA KEV listing. The apparent tension between the moderate CVSS score and SSVC 'Technical Impact: total' is not a conflict - it accurately describes a vulnerability that is difficult to set up but catastrophic when achieved: VC:H/VI:H/VA:H indicate full confidentiality, integrity, and availability compromise of the host. Real-world priority is elevated for organizations whose employees connect GlobalProtect from untrusted environments (public Wi-Fi, hotel networks, third-party offices), where MitM positioning is more accessible. In fully controlled enterprise network environments the risk is substantially lower. No data inconsistencies were identified; CVSS vector, SSVC, and EPSS signals are internally consistent.

An attacker on the same Wi-Fi segment as a corporate laptop running a vulnerable GlobalProtect App version deploys an ARP spoofing tool to position themselves between the client and the network gateway, then uses a rogue certificate or certificate pinning bypass to intercept the TLS session between GlobalProtect and the organization's Palo Alto Portal. The attacker injects a crafted malformed response payload timed to the Portal/Gateway handshake, triggering the out-of-bounds write in the GlobalProtect message parser and redirecting execution to shellcode that establishes a reverse shell with SYSTEM privileges. No public proof-of-concept has been identified at time of analysis, meaning exploitation requires independent vulnerability research to develop a working exploit.